@scriptc/compiler 0.0.8 → 0.0.10

package/dist/ir/nodes.d.ts

@@ -437,8 +437,16 @@ export declare function isSupportedMapValue(t: IrType): boolean;
 /** The INDEX-SIGNATURE value fence (`{ [k: string]: V }` shapes): the map
  * VALUE kinds — the overflow portion IS a string-keyed map — plus dyn
  * (`unknown`, an unknown-valued pricing-table shape: overflow reads surface ordinary
- * dyn values validated by the usual checked casts). Shared frontend
- * (mapType) / validator. */
+ * dyn values validated by the usual checked casts) and three kinds the
+ * overflow store carries that user Maps don't admit yet:
+ *   func — `Record<string, () => void>`, the command-registry pattern
+ *          (scr_closure adapters; closures are cycle-headered and traced,
+ *          so a handler capturing its own registry collects)
+ *   map/set — `Record<string, Map<K, V>>`/`Record<string, Set<T>>`
+ *          nested-container tables (scr_map adapters; a map value's own
+ *          cycle capability propagates through the trace fixpoint)
+ * Nested index-signature RECORDS ride the record kind like any other.
+ * Shared frontend (mapType) / validator. */
 export declare function isSupportedIndexValue(t: IrType): boolean;
 export declare function funcOf(params: IrType[], ret: IrType): IrType;
 /** The union FUNC/SET-arm sibling rule, shared by the frontend's union
@@ -552,6 +560,16 @@ export interface IrLibExport {
      * backends emit identical bytes by construction. */
     inboundBytesTrap?: string;
 }
+/** One runtime-trap overlay row: the profile's teaching (replaces the
+ * baseline human line as field 0) and/or remediation (the optional fourth
+ * field) for one runtime detected-trap code. At least one of the two is
+ * present, or the row is not emitted. Text is profile-validated free of
+ * the encoding's reserved bytes (SC4001). */
+export interface IrLibTrapOverlay {
+    code: string;
+    teaching?: string;
+    remediation?: string;
+}
 export interface IrLibSection {
     /** The profile's identity string (artifact header comments only). */
     profileName: string;
@@ -566,6 +584,15 @@ export interface IrLibSection {
      * posture (every entry prologue resets the arena). */
     resultResetSymbol: string | null;
     exports: IrLibExport[];
+    /** Profile-declared teaching/remediation overlays for the runtime
+     * detected-trap code family (SC4013–SC4019, diagnostics registry): both
+     * backends emit these as the program TU's overlay table
+     * (scr_library_trap_overlays — flat code/teaching/remediation triples)
+     * that the library trap funnel consults when it assembles a detected
+     * trap's structured sink message. Only declared codes appear, in the
+     * registry family's order, so the two emissions' data is identical by
+     * construction. */
+    trapOverlays: IrLibTrapOverlay[];
     /** The ask-2 identity getters (present exactly when the profile
      * declares a sidecar): pure data returns emitted with NO entry
      * prologue — exempt from the poisoned guard and every runtime touch
@@ -1171,7 +1198,12 @@ export type IrStrIntrinsicMethod = "length" | "charCodeAt" | "charAt" | "indexOf
  * DataView" RangeError on any bad offset. `dvGetBigUint64Number`/
  * `dvGetBigInt64Number` are the COMPOSED `Number(view.getBigUint64(...))`
  * lowerings — the bare bigint-returning calls are fenced, the wrapped
- * form converts the 8-byte integer to double exactly as Number(bigint). */
+ * form converts the 8-byte integer to double exactly as Number(bigint).
+ * The `dvSet*` setters mirror the getters: [offset, value] plus the
+ * optional bool littleEndian on the multi-byte kinds → void, the same
+ * constant RangeError on any bad offset; values coerce JS-exactly
+ * (integer kinds by modular truncation, Float32 by double→float
+ * rounding). No BIG setters exist — bigint arguments never lower. */
 export type IrBytesIntrinsicMethod = "length" | "byteLength" | "get" | "slice" | "setFrom" | "toString" | "readNum" | "writeNum" | "readNumVar" | "writeNumVar"
 /** The comparison/search/mutation surface (u8 receivers only; see the
  * runtime contract): `equals` [bytes] → bool (never throws);
@@ -1187,7 +1219,7 @@ export type IrBytesIntrinsicMethod = "length" | "byteLength" | "get" | "slice" |
  * f64 copied count, THROWS; `swap16/32/64` [] → the receiver (+1,
  * in-place), THROW; `writeStr` [string, strLit enc, f64 offset, f64
  * length?] → f64 bytes written, THROWS. */
- | "equals" | "compareBuf" | "indexOf" | "lastIndexOf" | "includes" | "indexOfNum" | "lastIndexOfNum" | "includesNum" | "fill" | "fillNum" | "fillStr" | "copy" | "swap16" | "swap32" | "swap64" | "writeStr" | "byteOffset" | "dataViewNew" | "dvGetUint8" | "dvGetInt8" | "dvGetUint16" | "dvGetInt16" | "dvGetUint32" | "dvGetInt32" | "dvGetFloat32" | "dvGetFloat64" | "dvGetBigUint64Number" | "dvGetBigInt64Number";
+ | "equals" | "compareBuf" | "indexOf" | "lastIndexOf" | "includes" | "indexOfNum" | "lastIndexOfNum" | "includesNum" | "fill" | "fillNum" | "fillStr" | "copy" | "swap16" | "swap32" | "swap64" | "writeStr" | "byteOffset" | "dataViewNew" | "dvGetUint8" | "dvGetInt8" | "dvGetUint16" | "dvGetInt16" | "dvGetUint32" | "dvGetInt32" | "dvGetFloat32" | "dvGetFloat64" | "dvGetBigUint64Number" | "dvGetBigInt64Number" | "dvSetUint8" | "dvSetInt8" | "dvSetUint16" | "dvSetInt16" | "dvSetUint32" | "dvSetInt32" | "dvSetFloat32" | "dvSetFloat64";
 /** The bytesIntrinsic methods that can raise a catchable error — backends'
  * may-throw analyses seed on these exactly like MAY_THROW_LIB_FNS. */
 export declare const MAY_THROW_BYTES_METHODS: ReadonlySet<IrBytesIntrinsicMethod>;
@@ -1271,11 +1303,22 @@ export type IrLibFn = "island.eval"
  * OBJ receiver sets the member (later writes win, insertion order
  * preserved — JS exactly); undefined/null throws Node's catchable
  * "Cannot set properties of undefined (setting 'k')"; every other kind
- * throws Node's STRICT-mode "Cannot create property 'k' on <kind>"
+ * throws Node's STRICT-mode "Cannot create property 'k' on <kind>" —
+ * primitives quoting their rendering, V8's "on number '5'"
  * (sloppy mode would silently ignore — suite tests are 'use strict';
  * SEMANTICS.md notes the sloppy divergence: loud, never silent). Void
  * result; in the may-throw seed set. */
  | "dyn.keySet"
+/** Destructuring pack over a dyn DOM source — `const [a, b] = d`, a
+ * destructured dyn callback param (args: the source and the STATIC
+ * TypeError spelling, "" when the source has none — both borrowed;
+ * result: a fresh DOM array, +1). Iterable kinds collect like spread
+ * (arrays element-by-element, strings by code point, bytes by byte);
+ * every other kind throws V8's destructuring TypeError — the spelling
+ * verbatim when non-empty, else the runtime kind wording ("number 5 is
+ * not iterable (cannot read property Symbol(Symbol.iterator))"). In the
+ * may-throw seed set. */
+ | "dyn.iterPack"
 /** Object.defineProperties over DOM values (args: target, descriptors —
  * both borrowed dyn; result: the target, +1 — JS's return value).
  * Value descriptors become plain own properties on OBJ and FUNC targets
@@ -1434,6 +1477,20 @@ export type IrLibFn = "island.eval"
  * result for negative fractions rounding to zero. The explicit-digits
  * forms keep their island lowering. Results +1; never throw. */
  | "num.toExponential" | "num.toFixed0"
+/** Object.is over two numbers — the spec's SameValue on doubles: NaN
+ * equals NaN, +0 differs from -0, everything else is `===`. Plain bool
+ * result; never throws. (Union-armed operands take unionEq's sameValue
+ * flag instead — this is the both-f64 fast path.) */
+ | "num.sameValue"
+/** `new Intl.NumberFormat("en-US").format(x)` and
+ * `x.toLocaleString("en-US")` with DEFAULT options — the one locale
+ * whose data the runtime embeds (Node's default-build locale): decimal
+ * notation, 0–3 fraction digits rounded half-up on the SHORTEST
+ * round-tripping decimal (ICU's rounding input, probed vs Node —
+ * format(1.0005) is "1.001" though toFixed(3) answers "1.000"), ","
+ * grouping every three integer digits, "∞"/"NaN" texts, and "-0" for
+ * negative inputs rounding to zero. Result +1; never throws. */
+ | "intl.numFormatEnUs"
 /** `delete process.env[NAME]` — unsetenv(3): the mutation is visible to
  * every later read (process.envGet asks getenv fresh) and inherited by
  * spawned children, exactly Node. Statement position only (JS's boolean
@@ -1629,7 +1686,18 @@ export type IrLibFn = "island.eval"
  * (handshake-completion timing); on a server without deferred
  * connections (a plain net server) the registration never fires,
  * exactly Node's split. */
- | "net.serverOnSecureConnection" | "net.connect" | "net.connectCb"
+ | "net.serverOnSecureConnection" | "net.connect"
+/** connect with a validated autoSelectFamilyAttemptTimeout option (the
+ * budget runs Node's validateInt32-from-1 ladder and is then inert —
+ * the single dial has nothing to time). May-throw. */
+ | "net.connectAttempt"
+/** net.connect/createConnection over a RUNTIME option bag (computed
+ * keys — the invalid-input probes): Node-order validation (the
+ * objectMode trio's ERR_INVALID_ARG_VALUE, validatePort, host string,
+ * autoSelectFamily boolean, the attempt budget), then the trailing
+ * compiler-rendered fence — ALWAYS THROWS (the error.nodeThrow
+ * polymorphic-result carve-out). May-throw seed. */
+ | "net.connectOptsChk" | "net.connectCb"
 /** connect({ port, host, autoSelectFamily: true, lookup }) — the
  * caller-resolver dial (portless's createLoopbackConnection): args
  * [port, host, lookup]. The runtime creates the (connecting) socket
@@ -1671,7 +1739,13 @@ export type IrLibFn = "island.eval"
  * defers the callback to the next turn (SEMANTICS.md documents the
  * blocking divergence); its per-union adapter builds the
  * `Error | null` first argument. */
- | "dgram.createSocket" | "dgram.bind" | "dgram.bindCb" | "dgram.connect" | "dgram.connectCb" | "dgram.sendStr" | "dgram.sendBytes" | "dgram.address" | "dgram.close" | "dgram.closeCb" | "dgram.unref" | "dgram.ref" | "dgram.onMessage" | "dgram.onError" | "dgram.onListening" | "dgram.onClose" | "dgram.onConnect" | "dns.lookup"
+ | "dgram.createSocket" | "dgram.bind" | "dgram.bindCb" | "dgram.connect" | "dgram.connectCb" | "dgram.sendStr" | "dgram.sendBytes"
+/** The send argument-validation ladder over DOM arguments (Node's
+ * signature shuffle: slice bounds, list/type contracts, port/address
+ * validation, connected-state errors) — a fully-validated unconnected
+ * single-payload send RUNS; callback/list/connected forms meet the
+ * trailing fence. May-throw. */
+ | "dgram.sendChk" | "dgram.address" | "dgram.close" | "dgram.closeCb" | "dgram.unref" | "dgram.ref" | "dgram.onMessage" | "dgram.onError" | "dgram.onListening" | "dgram.onClose" | "dgram.onConnect" | "dns.lookup"
 /** node:test (scr_test.c — linked only when one of these appears on
  * the IR; moduleUsesNodeTest is the switch, and the main epilogue asks
  * scr_test_exit_code() for the process's exit status). Strings are
@@ -1847,7 +1921,17 @@ export type IrLibFn = "island.eval"
 /** tls.createSecureContext({ cert, key }) — parses the PEM pair into an
  * opaque SecureContext handle (secureCtx kind) for SNI callbacks to
  * answer with; cert/key are PEM strings or Buffers like createServer's. */
- | "tls.createSecureContext" | "https.createServer" | "https.request" | "https.requestCb"
+ | "tls.createSecureContext"
+/** createSecureContext over a RUNTIME options record (the checked-
+ * dynamic lane): Node's typed option validations first (the ciphers/
+ * passphrase/engine/version/timeout/ticketKeys ladders), then the pem
+ * walk — a validated { cert, key } bag builds the real context.
+ * May-throw. */
+ | "tls.createSecureContextDyn"
+/** tls.getCACertificates(type): validateString + the documented name
+ * set, then the trailing compiler-rendered fence — ALWAYS THROWS (the
+ * error.nodeThrow polymorphic-result carve-out). May-throw seed. */
+ | "tls.caCertsChk" | "https.createServer" | "https.request" | "https.requestCb"
 /** A call through a `const requestFn = tls ? https.request :
  * http.request` binding — the module-function-as-value ternary between
  * the two known clients: the https.request row with a leading `secure`
@@ -1961,6 +2045,51 @@ export type IrLibFn = "island.eval"
  * zero-padded to the total. THROWS Node's 'length' RangeError on a
  * negative/non-integer total (may-throw seed). */
  | "buffer.concatLen"
+/** The checked-dynamic compare/equals validators (scr_bytes_io.c) —
+ * the lowered form when an argument is NOT statically bytes<u8> (the
+ * invalid-input probes; a dyn from an untyped JS helper): Node's own
+ * argument ladders run at runtime — ERR_INVALID_ARG_TYPE with the
+ * API's argument name ("buf1"/"buf2", "otherBuffer", "target"; offsets
+ * "of type number"), validateOffset's ERR_OUT_OF_RANGE for bad
+ * numbers, undefined offsets taking their Node defaults — and a
+ * well-typed value still computes the real answer. All args borrowed
+ * dyn; compareChk's four offset slots pass the undefined dyn when
+ * syntactically absent. May-throw seeds. */
+ | "buffer.compareChk" | "bytes.equalsChk" | "bytes.compareChk"
+/** The deprecated `new Buffer(number, 'enc')` string-arm rejection:
+ * always throws Node's ERR_INVALID_ARG_TYPE ("The \"string\" argument
+ * must be of type string. Received ..."). Borrowed dyn; may-throw. */
+ | "buffer.newStringFail"
+/** fs._toUnixTimestamp(time) over a DOM value: numeric strings and
+ * finite numbers coerce (negatives answer now/1000, Node's shape);
+ * everything else throws Node's ERR_INVALID_ARG_TYPE. May-throw. */
+ | "fs.toUnixTimestamp"
+/** The fs argument-validation ladders (checked-dynamic lane): each Chk
+ * replicates its API's Node-order validation over DOM values (Node's
+ * exact typed errors — ERR_INVALID_ARG_TYPE/VALUE, ERR_OUT_OF_RANGE),
+ * and a full pass meets the trailing compiler-rendered SC2020 fence
+ * string — so the ALWAYS-THROW forms take the error.nodeThrow
+ * polymorphic-result carve-out. mkdtempSyncChk and the lchmod sync/
+ * promise pair run the REAL operation on a validated pass instead
+ * (macOS lchmod(2); non-APPLE answers Node's not-a-function /
+ * ERR_METHOD_NOT_IMPLEMENTED shapes). May-throw seeds, all of them. */
+ | "fs.existsChk" | "fs.mkdtempChk" | "fs.mkdtempSyncChk" | "fs.readFileChk" | "fs.opendirChk" | "fs.watchFileChk" | "fs.lchmodChk" | "fs.lchmodSyncChk" | "fsp.lchmodChk" | "fs.readChk" | "fs.streamOptsChk"
+/** The compiler-resolved ERR_INVALID_ARG_TYPE throw with a RUNTIME-
+ * rendered Received tail: args [argname, "of type ..." clause, the
+ * offending DOM value]. ALWAYS THROWS; polymorphic result (the
+ * error.nodeThrow pattern). May-throw seed. */
+ | "error.argTypeThrow"
+/** The property flavor of argTypeThrow ("The \"options.x\" property
+ * must be ..."): the option-bag ladders' provably-invalid arms. ALWAYS
+ * THROWS; polymorphic result. May-throw seed. */
+ | "error.propTypeThrow"
+/** The checked-dynamic max-listeners ladders: setMaxChk is the
+ * instance form over a DOM n (non-numbers ERR_INVALID_ARG_TYPE,
+ * negatives/NaN ERR_OUT_OF_RANGE; +1 receiver back — chaining);
+ * setDefaultMaxChk is the static/property form, its second argument
+ * naming the message slot ("setMaxListeners" for the static call,
+ * "defaultMaxListeners" for the module-property assignment). */
+ | "emitter.setMaxChk" | "emitter.setDefaultMaxChk"
 /** The Buffer forms of the fs quartet: readFileSync(path) with NO
  * encoding → bytes<u8> (+1), writeFileSync(path, bytes), and the
  * fs/promises readFile(path) no-encoding form (an already-settled
@@ -2185,6 +2314,20 @@ export type IrLibFn = "island.eval"
  * field to stamp. error.toString: borrowed `%Error`-typed receiver, +1
  * string in Node's "name: message" shape. None of the three throws. */
  | "error.new"
+/** The compiler-resolved Node-parity throw for always-throwing lowered
+ * arms (ERR_INVALID_THIS receivers, ERR_MISSING_ARGS arity ladders,
+ * the symbol-to-string TypeError): args are [error-kind f64 (the
+ * SCR_ERR_* index: 0 Error, 1 TypeError, 2 RangeError), code (empty =
+ * no code slot), message]. ALWAYS THROWS catchably; the result type is
+ * the replaced expression's own (never materialized — the
+ * global.undefRead pattern). May-throw seed. */
+ | "error.nodeThrow"
+/** JS ToString over a DOM value WITH the object protocol (a user
+ * toString/valueOf member is CALLED and its throw propagates;
+ * exhaustion throws "Cannot convert object to primitive value"; units
+ * render "null"/"undefined") — the WHATWG USVString conversions
+ * (URLSearchParams names/values). Borrowed dyn; +1 string. May-throw. */
+ | "dyn.toStringCoerce"
 /** A read of a `declare`d const NOTHING defines (the bundler-define
  * pattern — __VERSION__): always throws the catchable ReferenceError
  * Node raises at the access ("<name> is not defined"). args[0] is the
@@ -2239,7 +2382,32 @@ export type IrLibFn = "island.eval"
  * JS). Strings/arrays/bytes answer their index keys; other scalars an
  * empty array; null/undefined throw Node's catchable TypeError
  * ("Cannot convert undefined or null to object"). */
- | "dyn.objKeys" | "dyn.hasOwn" | "dyn.assign" | "dyn.objValues" | "dyn.objEntries"
+ | "dyn.objKeys" | "dyn.hasOwn" | "dyn.assign"
+/** Variadic Object.assign over CHECKED-DYNAMIC targets (`Object.assign(
+ * {}, ...arr.map(f), tail)` — the option-table merge): the lowering
+ * builds one fresh DOM pack of sources (packPush retains a plain source
+ * in; packPushSpread flattens a spread source through the spread-call
+ * walk — V8's exact TypeError texts, the string arg spelling the spread
+ * expression for the nullish form), so every source evaluates and
+ * flattens BEFORE any copying (JS's ArgumentListEvaluation), then
+ * assignAll copies each pack element's own enumerable keys onto the
+ * target left to right and answers the TARGET (+1) — identity, like JS.
+ * assignAll throws Node's ToObject TypeError on a nullish target. */
+ | "dyn.packPush" | "dyn.packPushSpread"
+/** The iterated-path spread twin: V8 spells the optimized apply-path
+ * texts (packPushSpread's — the expression named for nullish sources)
+ * only for the SINGLE LAST argument's spread; any other spread position
+ * drives the real iterator protocol, whose failure describes the VALUE
+ * ("object null is not iterable (cannot read property
+ * Symbol(Symbol.iterator))"). The frontend picks by position. */
+ | "dyn.packPushSpreadIter" | "dyn.assignAll"
+/** `Object.create(null)` (scr_json.c): a fresh NULL-PROTOTYPE DOM
+ * dictionary. The DOM's OBJ dispatch is already own-member-only —
+ * Node's null-proto answer — so the flag's whole job is the observations
+ * that SEE the prototype: inspect's "[Object: null prototype]" prefix
+ * and deepStrictEqual's prototype gate. Never throws. Static builds
+ * only; --dynamic routes Object.create through the engine instead. */
+ | "dyn.objCreateNullProto" | "dyn.objValues" | "dyn.objEntries"
 /** structuredClone over the DOM (scr_json.c): the JSON-safe subset plus
  * bytes (a fresh copy — a Buffer clones as a plain Uint8Array, like
  * Node), deep. Functions and handle kinds throw the spec's catchable
@@ -2343,7 +2511,13 @@ export type IrLibFn = "island.eval"
  * propagates the first error by destroying the rest, calls cb after the
  * last 'close'; answers the destination +1. The Dyn twins take the
  * callback as a checked-dynamic VALUE (mustCall wrappers). */
- | "stream.finished" | "stream.finishedDyn" | "stream.pipeline" | "stream.pipelineDyn" | "readable.newDyn" | "writable.newDyn" | "duplex.newDyn" | "transform.newDyn" | "passthrough.newDyn" | "readable.initDyn" | "writable.initDyn" | "duplex.initDyn" | "transform.initDyn" | "passthrough.initDyn" | "readable.push" | "readable.pushStr" | "readable.pushNull" | "readable.pushU" | "readable.pushDyn" | "readable.unshift" | "readable.unshiftStr" | "readable.read" | "readable.pause" | "readable.resume" | "readable.setEncoding"
+ | "stream.finished" | "stream.finishedDyn" | "stream.pipeline" | "stream.pipelineDyn"
+/** node:stream/promises — the promise forms over the same machinery:
+ * sp.finished: (s) → a pending void promise the terminal watcher
+ * settles; sp.pipeline: (count, s1..sn) → the callback pipeline's
+ * chaining/destroyer semantics settling a void promise (fulfilled on a
+ * clean finish, rejected with the finish status otherwise). */
+ | "sp.finished" | "sp.pipeline" | "readable.newDyn" | "writable.newDyn" | "duplex.newDyn" | "transform.newDyn" | "passthrough.newDyn" | "readable.initDyn" | "writable.initDyn" | "duplex.initDyn" | "transform.initDyn" | "passthrough.initDyn" | "readable.push" | "readable.pushStr" | "readable.pushNull" | "readable.pushU" | "readable.pushDyn" | "readable.unshift" | "readable.unshiftStr" | "readable.read" | "readable.pause" | "readable.resume" | "readable.setEncoding"
 /** for-await over a readable (the desugared loop's per-pass promise):
  * +1 promise of the next chunk — buffered content, the EOF sentinel
  * (empty Buffer / dyn undefined), or a rejection with the stream's
@@ -3555,6 +3729,23 @@ export type IrExpr = {
     type: IrType;
     loc: SrcLoc;
 }
+/** Island value → dyn DOM conversion (`type` is always dyn; the operand
+ * is always jsval): the jsval→DOM crossing — an 'any'-typed engine
+ * value flowing into an 'unknown'/'object'/JS-residue slot wraps BY
+ * REFERENCE as the DOM's SCR_DYN_JSVAL kind (scr_dyn_from_jsval).
+ * Engine scalars (number/string/boolean/null/undefined) normalize to
+ * the native DOM kinds at wrap time, so wrapped nodes only ever hold
+ * engine objects/arrays/functions; typeof/truthiness/String()/=== on
+ * the wrapped node route to the engine, un-armed DOM walks fence
+ * loudly, and scr_jsval_from_dyn unwraps the SAME engine value back
+ * (identity round trip). The operand is borrowed; the result is owned
+ * (+1). Never throws. */
+ | {
+    kind: "dynFromJsval";
+    value: IrExpr;
+    type: IrType;
+    loc: SrcLoc;
+}
 /** CALLING a dyn DOM value — `fn(a, b)` where fn is checked-dynamic (an
  * implicit-any JS binding, a dyn record member, a dynKeyGet result).
  * Arguments are ALREADY dyn-typed (typed values box through dynFrom at
@@ -3567,12 +3758,26 @@ export type IrExpr = {
  * message exactly). A function callee calls through the boxed thunk:
  * per-arg validation against the boxed signature (mismatches throw the
  * path-annotated TypeError), result converted back to dyn. Callee and
- * args are borrowed; the result is owned (+1). MAY THROW. */
+ * args are borrowed; the result is owned (+1). MAY THROW.
+ *
+ * `spreads` (the runtime-arity form — `f(...args)`, the rest-forwarding
+ * idiom): entries name indices into `args` whose DOM values FLATTEN into
+ * the argument vector at the call — JS's spread over the DOM's iterable
+ * kinds (arrays element-by-element, strings by code point, bytes by
+ * byte; every other kind throws V8's exact spread-call TypeError,
+ * catchably — `what` is the spread expression's source spelling, which
+ * the nullish text spells), evaluated and flattened left-to-right (JS's
+ * ArgumentListEvaluation). The emitters build one fresh argument array
+ * and apply through it. */
  | {
     kind: "dynCall";
     callee: IrExpr;
     calleeName: string;
     args: IrExpr[];
+    spreads?: {
+        arg: number;
+        what: string;
+    }[];
     type: IrType;
     loc: SrcLoc;
 }
@@ -3941,11 +4146,15 @@ export type IrExpr = {
  * comparison (`u === "text"`) arrives here after the frontend wraps the
  * plain side (payload identity is preserved by the wrap, so ref-arm
  * semantics stay JS-exact). Operands are borrowed; result is a plain
- * bool. `negated` is the `!==` spelling. */
+ * bool. `negated` is the `!==` spelling. `sameValue` upgrades the f64
+ * arm's compare from `===` to SameValue (NaN equals NaN, +0 differs
+ * from -0) — the Object.is lowering; every other arm's compare is
+ * shared between the two semantics. */
  | {
     kind: "unionEq";
     unionId: string;
     negated: boolean;
+    sameValue: boolean;
     left: IrExpr;
     right: IrExpr;
     type: IrType;
@@ -4117,6 +4326,15 @@ export type IrJsOp = "add" | "sub" | "mul" | "div" | "mod" | "pow" | "neg" | "pl
  * engine, Symbol.hasInstance included; a non-object RHS throws the
  * engine's own TypeError, bridged catchably. */
  | "instanceOf" | "truthy" | "not" | "typeof" | "toStr" | "getProp" | "setProp" | "getIdx" | "setIdx" | "callMethod" | "callFn"
+/** Spread application on an island callee — `f(...pre, ...s)`, the
+ * rest-forwarding idiom (`(...args) => g(...args)` under --dynamic).
+ * Args are exactly (callee, pre, spread): `pre` is the engine array of
+ * leading fixed arguments (jsOp arrLit), `spread` the spread source;
+ * `name` carries the spread expression's source spelling (V8's nullish
+ * spread-call TypeError spells it). The prelude helper uses REAL spread
+ * syntax, so iterator protocols are the engine's own, with guards
+ * front-running V8's exact spread-call TypeError texts. May throw. */
+ | "callSpread"
 /** `new X(...)` where X is jsval-typed (package-declared classes):
  * JS_CallConstructor — args are the callee then the constructor
  * arguments, mirroring callFn. */

package/dist/ir/nodes.js

@@ -155,10 +155,22 @@ export function isSupportedMapValue(t) {
 /** The INDEX-SIGNATURE value fence (`{ [k: string]: V }` shapes): the map
  * VALUE kinds — the overflow portion IS a string-keyed map — plus dyn
  * (`unknown`, an unknown-valued pricing-table shape: overflow reads surface ordinary
- * dyn values validated by the usual checked casts). Shared frontend
- * (mapType) / validator. */
+ * dyn values validated by the usual checked casts) and three kinds the
+ * overflow store carries that user Maps don't admit yet:
+ *   func — `Record<string, () => void>`, the command-registry pattern
+ *          (scr_closure adapters; closures are cycle-headered and traced,
+ *          so a handler capturing its own registry collects)
+ *   map/set — `Record<string, Map<K, V>>`/`Record<string, Set<T>>`
+ *          nested-container tables (scr_map adapters; a map value's own
+ *          cycle capability propagates through the trace fixpoint)
+ * Nested index-signature RECORDS ride the record kind like any other.
+ * Shared frontend (mapType) / validator. */
 export function isSupportedIndexValue(t) {
-    return t.kind === "dyn" || isSupportedMapValue(t);
+    return (t.kind === "dyn" ||
+        t.kind === "func" ||
+        t.kind === "map" ||
+        t.kind === "set" ||
+        isSupportedMapValue(t));
 }
 export function funcOf(params, ret) {
     return { kind: "func", params, ret };
@@ -461,6 +473,14 @@ export const MAY_THROW_BYTES_METHODS = new Set([
     "dvGetFloat64",
     "dvGetBigUint64Number",
     "dvGetBigInt64Number",
+    "dvSetUint8",
+    "dvSetInt8",
+    "dvSetUint16",
+    "dvSetInt16",
+    "dvSetUint32",
+    "dvSetInt32",
+    "dvSetFloat32",
+    "dvSetFloat64",
 ]);
 /** Result-type rule for each island op (the validator enforces it; the
  * frontend constructs nodes with exactly these). */
@@ -478,6 +498,7 @@ export function jsOpResultKind(op) {
         case "getIdx":
         case "callMethod":
         case "callFn":
+        case "callSpread":
         case "construct":
         case "globalGet":
         case "objLit":
@@ -849,7 +870,12 @@ export function canConvertToDyn(t, getRecord, getUnion) {
     }
     if (t.kind === "union") {
         const def = getUnion(t.unionId);
-        return !!def && def.arms.every((a) => a.kind === "undefinedT" || isJsonSafeType(a, getRecord, getUnion));
+        // JSON-safe arms box as before; BOXABLE FUNCTION arms join them (the
+        // invalid-input probes iterate `[1, null, () => {}, true]` — the
+        // union's func arm crosses through the checked-dynamic function
+        // boundary exactly like a bare func dynFrom).
+        return !!def && def.arms.every((a) => a.kind === "undefinedT" || isJsonSafeType(a, getRecord, getUnion) ||
+            (a.kind === "func" && canBoxFuncIntoDyn(a, getRecord, getUnion)));
     }
     return false;
 }
@@ -925,8 +951,15 @@ export function canDynCheckTo(t, getRecord, getUnion) {
  * back). */
 export function canBoxFuncIntoDyn(t, getRecord, getUnion) {
     return (t.kind === "func" &&
-        t.params.every((p) => p.kind === "dyn" || canDynCheckTo(p, getRecord, getUnion)) &&
-        (t.ret.kind === "void" || t.ret.kind === "dyn" || canConvertToDyn(t.ret, getRecord, getUnion)));
+        // A jsval (island) param converts through scr_jsval_from_dyn in the
+        // thunk (wrapped cells unwrap by reference, DOM data deep-copies) —
+        // the checker-'any' callback params of the routed-dispatch lane
+        // (`bag.list.map((x) => ...)` with x typed any).
+        t.params.every((p) => p.kind === "dyn" || p.kind === "jsval" || canDynCheckTo(p, getRecord, getUnion)) &&
+        // A jsval return converts through the by-reference wrap
+        // (dynFromJsval — the thunk's result conversion), so engine-returning
+        // callbacks box too: the routed-dispatch lane's flatMap shape.
+        (t.ret.kind === "void" || t.ret.kind === "dyn" || t.ret.kind === "jsval" || canConvertToDyn(t.ret, getRecord, getUnion)));
 }
 /** A closure type a dyn function value can ADAPT to (dynCheck): every
  * param dyn or dyn-convertible (the adapter converts typed arguments into
@@ -1149,6 +1182,7 @@ export function moduleUsesStream(mod) {
                 node.fn.startsWith("passthrough.") ||
                 node.fn === "stream.destroy" || node.fn === "stream.destroyErr" ||
                 node.fn === "stream.prop" || node.fn === "stream.errored" ||
+                node.fn === "sp.finished" || node.fn === "sp.pipeline" ||
                 node.fn.startsWith("stream.set"))) {
             found = true;
             return;
@@ -1708,6 +1742,10 @@ export function moduleUsesTls(mod) {
 /** libCall families a v1 library artifact refuses, with the surface name the SC4005
  * teaching uses. Prefix match over IrLibFn spellings. */
 const LIB_MODE_REFUSED_PREFIXES = [
+    // fs.exists is the one CALLBACK-async fs op with a real implementation:
+    // its fire rides the timer queue (scr_bytes_io.c), which library links
+    // exclude — refuse the surface like the rest of the event-loop family.
+    ["fs.existsChk", "the async fs callback surface (fs.exists)"],
     ["timers.", "the timers surface (setTimeout family)"],
     ["tp.", "the timers/promises surface"],
     ["cp.", "the child_process surface"],
@@ -1946,6 +1984,8 @@ export const MAY_THROW_LIB_FNS = new Set([
     // divergence-66 stance).
     "tls.pemDyn",
     "tls.createServerDyn",
+    "tls.createSecureContextDyn",
+    "tls.caCertsChk",
     "tls.createServerDynCb",
     "https.createServerDyn",
     "https.createServerDynCb",
@@ -2007,6 +2047,8 @@ export const MAY_THROW_LIB_FNS = new Set([
     "stream.finishedDyn",
     "stream.pipeline",
     "stream.pipelineDyn",
+    "sp.finished",
+    "sp.pipeline",
     "readable.newDyn",
     "writable.newDyn",
     "duplex.newDyn",
@@ -2058,6 +2100,10 @@ export const MAY_THROW_LIB_FNS = new Set([
     // A read of a declare-d const nothing defines: always throws Node's
     // catchable ReferenceError.
     "global.undefRead",
+    // The compiler-resolved Node-parity throw: always throws, catchably.
+    "error.nodeThrow",
+    // USVString coercion runs user toString/valueOf — throws propagate.
+    "dyn.toStringCoerce",
     "child.kill",
     // The caller's lookup runs synchronously inside the connect call — a
     // throw there propagates like Node's.
@@ -2104,6 +2150,11 @@ export const MAY_THROW_LIB_FNS = new Set([
     "dyn.objKeys",
     "dyn.hasOwn",
     "dyn.assign",
+    // variadic Object.assign: spread flattening throws V8's spread-call
+    // TypeErrors; the final copy throws ToObject on a nullish target
+    "dyn.packPushSpread",
+    "dyn.packPushSpreadIter",
+    "dyn.assignAll",
     "dyn.objValues",
     "dyn.objEntries",
     "error.domClone",
@@ -2111,6 +2162,8 @@ export const MAY_THROW_LIB_FNS = new Set([
     // throws Node's catchable SyntaxError at construction.
     "regex.new",
     "dyn.keySet",
+    // the destructuring pack throws V8's TypeError on non-iterable DOM kinds
+    "dyn.iterPack",
     "dyn.toString",
     "dyn.defineProps",
     "process.chdir",
@@ -2139,6 +2192,31 @@ export const MAY_THROW_LIB_FNS = new Set([
     "crypto.randomBytesToString",
     "crypto.randomBytes",
     "buffer.concatLen",
+    // The checked-dynamic compare/equals validators: Node's argument
+    // ladders throw ERR_INVALID_ARG_TYPE / ERR_OUT_OF_RANGE catchably.
+    "buffer.compareChk",
+    "bytes.equalsChk",
+    "bytes.compareChk",
+    "buffer.newStringFail",
+    "fs.toUnixTimestamp",
+    "fs.existsChk",
+    "fs.mkdtempChk",
+    "fs.mkdtempSyncChk",
+    "fs.readFileChk",
+    "fs.opendirChk",
+    "fs.watchFileChk",
+    "fs.lchmodChk",
+    "fs.lchmodSyncChk",
+    "fsp.lchmodChk",
+    "fs.readChk",
+    "fs.streamOptsChk",
+    "net.connectAttempt",
+    "net.connectOptsChk",
+    "net.setAutoSelTimeout",
+    "error.argTypeThrow",
+    "error.propTypeThrow",
+    "emitter.setMaxChk",
+    "emitter.setDefaultMaxChk",
     "fs.readFileSyncBytes",
     "fs.writeFileSyncBytes",
     "zlib.inflateSync",
@@ -2159,6 +2237,7 @@ export const MAY_THROW_LIB_FNS = new Set([
     "dgram.connectCb",
     "dgram.sendStr",
     "dgram.sendBytes",
+    "dgram.sendChk",
     "dgram.address",
     "dgram.close",
     "dgram.closeCb",